How to Choose a Cloud Computing Vendor

The promise of cloud computing is that it can be like a ray of sunshine for a business that needs to increase information technology capacity or capabilities quickly without being bogged down by the expense of buying new infrastructure, licensing software, and training staff. These days, businesses can find a pot of savings at the end of the rainbow by paying for IT services -- including infrastructure, software, security, and even collaboration platforms -- on a subscription or a pay-per-usage basis.

When it comes to choosing a cloud computing vendor, however, there are thousands of options. And finding the right one can be as tricky as predicting the weather.

That means small and mid-sized businesses need to do some homework before plunging into a cloud computing agreement with a vendor. "There are some key factors you need to consider before you start looking," says Vince DiMemmo, general manager of cloud and IT services at infrastructure services-provider Equinix, which operates more than 90 data centers in 35 markets around the world supporting many of the leading cloud computing platforms. "There's a wide landscape of services out there, and you want to fundamentally stay true to how you run IT today in terms of availability, security, performance, and overall business suitability."

The following guide will review how to determine whether or not cloud computing is suitable for your business, what criteria to look for in a vendor, and how to research cloud computing vendors.

The first question you need to answer is whether a cloud computing solution is right for your business. For many small and mid-sized businesses, or start-ups, managing computer systems and networks can distract from running other, more fundamental aspects of running a business. Between computers that crash, software that needs to be upgraded, and morphing security risks from Internet connectivity, it's a full-time job. If you don't have an IT department or you don't have the resources to grow that department, it may make more sense to outsource some of your IT needs. That's one reason why the concept of cloud computing is so appealing to a growing number of companies.

There are other business benefits to cloud computing, as well. Cloud computing providers can often offer businesses lower prices for access to more sophisticated technology because you share those IT resources with other companies, thereby reducing the overhead costs to the vendor of licensing software or buying servers. In addition, the pay-as-you-go nature of some cloud computing contracts enables businesses to pay for only what they use -- if only five staff members need access to the financial software, they can pay for only those five people instead of buying a license for 100 users. Many contracts can also allow businesses to ramp up quickly to help facilitate quick growth.

In order to achieve these benefits, business leaders need to understand what types of cloud offerings would be most suitable, what the company's needs are, and which vendors offer the best fit.

These are a few of the different types of cloud computing offerings:• Infrastructure-as-a-service: This used to be known as "utility computing," wherein the vendor supplies the network and servers and your business uses that infrastructure and pays for what it uses in terms of capacity and storage.• Platform-as-a-service: The vendor provides and manages for you the operating system and the database and everything else you need to run certain platforms.• Software-as-a-service: This option involves the vendor running your software application for you, so that your business doesn't have to buy a software license from Oracle or Microsoft or other providers.

Once you determine the type of cloud service is most suitable for your business, the next step you need to undertake is to determine your company's needs. "You should start by doing a workload analysis," says Ralph Presciutti, a partner in the technology practice at Tatum, an executive services firm. "How much computing power do you really need? You might have an infrastructure with 100 servers, but you have to ask yourself, 'Am I really using that much power?' The national average is that two to 12 percent of all computer resources are utilized."

On the infrastructure side, you can hire consultants to help you determine your needs. In addition, some companies, such as VMware and Cirba have products that can help businesses determine server needs.

There are literally scores of cloud computing vendors to choose from. Everyone from Google (Google App Engine) and Microsoft (Microsoft Azure) to Rackspace and Salesforce.com has a cloud computing service or platform. When setting out to choose a cloud provider, keep in mind that you need to analyze your choices on a few different levels.

• The product: Is the product easy to use? Does it provide your business what it needs? Will it help you better meet business goals?• The provider: Is the provider a stable company with lots of other customers? Are those customers happy with the customer service? Is the provider well-funded and/or is it a possible acquisition target?• The transition: Is the transition something that will be accomplished during your timetable? Do you understand what is involved and the possible interruptions to business during the transition?

Assemble a list of providers. You can gather this information from magazine and news sources. You can get referrals from other businesses or business or industry groups. You can look to IT research companies, such as Gartner, Forrester, and IDC. You can also hire outside consultants to help your company find the right fit in a cloud computing vendor. In addition, there may be providers that specialize in solutions for your industry.

Once you have a list of prospective vendors, you need to gather answers to some fundamental questions involving availability, security, performance, and customer service.

Availability"Will the service be up and running when your business needs it most? Or will there be downtimes or unacceptable levels of application latency that may cost you customers or productivity? From an availability perspective, it's important to understand if the service is deployed on an underlying infrastructure that is backed up with a meaningful service level agreement," DiMemmo says. "You already have fundamental expectations of your service levels if you are managing your own IT today. When you move to the cloud, you minimally want to achieve that availability or better to ensure the performance of your infrastructure and applications."

The level of availability you need depends on the criticality of the service to your business. If you're looking to move your financial, CRM, or business intelligence systems to the cloud, it's likely very important for the cloud service to be highly available. But if it's a secondary application that is only utilized occasionally and not business critical, you may not need such high availability, and you can broaden your cloud provider landscape, DiMemmo says.

Security"The biggest concern about cloud computing is security," says Presciutti. That includes the physical security of the cloud environment -- where is the data center that houses the vendor's servers and what is their plan if there is a tornado or hurricane? But it also refers to the security of the information your business maintains. Given that there are a host of new laws requiring businesses to protect personal information of customers, you need assurances that your cloud provider will abide by those same laws and help you protect that data. In addition, you don't want breaches of sensitive company information.

"Everyone's big objection is taking corporate information outside the four walls," Presciutti says. "The cloud environment is shared. Your data might be running on the same servers or storage media as your competitors' or other companies'. You have to ask yourself do you really want to have your data co-located with someone else's." This key objection has been addressed by many vendors that include security for both "data in motion" and "data at rest," Presciutti says. Most vendors approach cloud security through the conventional means of various levels of encryption, firewalls, etc. Other companies, such as Unisys, have a different method they call "stealth" (reportedly developed for the U.S. Department of Defense) that in addition to the widely used encryption technologies also splits the bits of data as they traverse the network and are stored on media.

If your company needs to meet Payment Card Industry (PCI) compliance or Statement on Auditing Standards No. 70 (SAS70), you need assurances that your provider complies with those standards, as well.

PerformanceA few years ago, the early promoters and adopters of cloud computing were happy to see the fundamental promise of cloud services coming to market, DiMemmo says. Now that the cloud services have matured, and the adoption has progressed in the business community, the expectations are that service performance levels are critical since these services are now supporting a growing number of business-critical systems that make businesses run. "Companies are saying 'We need it to work as well as or better than when it was in our own data center,'" DiMemmo says. "Today, the cloud provider now has to have performance metrics."

Some of the key questions to ask when looking for a vendor include the following: How does the cloud service provider define performance? What metrics do they use? How does their definition of performance relate to end user satisfaction?

Customer Service Ultimately, your choice may come down to a gut feeling about which cloud computing vendor you would prefer to do business with. There are a lot of questions you need to ask. How quickly does a vendor return your calls? How transparent are they in discussing what kind of technology they use or who their providers are and how often they have downtime? Do they answer your questions about the servers they use and the software they run and their disaster recovery plans?

"There are other ways to measure a vendor's merit, as well. Ask for referrals and check up on as many as you can. If you're thinking about moving a highly critical business application to the cloud, ask to visit their data center as it will tell you a lot about their capability. And, ultimately, you want to determine whether the vendor is willing to put their promises in writing in the form of a service level agreement (SLA). If the vendor relies on other software and hardware and infrastructure players to keep their service up and running, make sure all the promises in the underlying SLAs align properly," DiMemmo says.

Hopefully you will never have to assess penalties for the vendor's failure to perform as promised, but it's a measure of the vendor's confidence in their products and services if they are willing to include penalties in the SLA. "You really want to make sure that there is confidence in the service," DiMemmo says. "If the underlying providers are willing to share some level of risk in delivery, it's a good indicator those folks are confident in their infrastructure."